CVE-2025-63604

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. The vulnerability stems from the exposure of dangerous Python built-in functions (__import__, getattr, hasattr) in the execution namespace and the direct use of exec() to execute user-supplied code. An attacker can craft malicious queries to execute arbitrary Python code, leading to AWS credential theft (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), file system access, environment variable disclosure, and potential system compromise. The vulnerability allows attackers to bypass intended security controls and gain unauthorized access to sensitive AWS resources and credentials stored in the server's environment.

• CWE-77

• https://github.com/baryhuang/mcp-server-aws-resources-python/issues/8Exploit, Issue Tracking, Third Party Advisory

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6359A vulnerability was found in code-projects Simple Pizza Orde…9.8
• CVE-2025-63593Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS)…6.1
• CVE-2025-6360A vulnerability classified as critical has been found in cod…9.8
• CVE-2025-63601Snipe-IT before version 8.3.3 contains a remote code executi…9.9
• CVE-2025-63602A vulnerability was discovered in Awesome Miner thru 11.2.4 …7.3
• CVE-2025-63603A command injection vulnerability exists in the MCP Data Sci…6.5
• CVE-2025-63608A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in t…5.4
• CVE-2025-6361A vulnerability classified as critical was found in code-pro…9.8
• CVE-2025-63611Cross-Site Scripting in phpgurukul Hostel Management System …8.7
• CVE-2025-63617ktg-mes before commit a484f96 (2025-07-03) has a fastjson de…6.5
• CVE-2025-6362A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-63622A vulnerability was found in code-projects Online Complaint …9.8